The Agent Skills Directory

[COMMAND_EXECUTION]: Guides the execution of security tools including npm audit, gitleaks, and trivy. These are standard tools used for their intended purpose of security auditing.
[EXTERNAL_DOWNLOADS]: Utilizes npx to execute tools like snyk and spdx-tool. These downloads originate from well-known public registries and are standard for security analysis workflows.
[PROMPT_INJECTION]: The skill processes untrusted output from external security tools (such as vulnerability reports). This introduces an indirect prompt injection surface where malicious content in scanned files could attempt to influence agent behavior through tool output.
Ingestion points: Tool outputs from npm audit, snyk, trivy, and gitleaks are ingested into the agent context via terminal output.
Boundary markers: None identified in the skill instructions to delimit tool output from agent instructions.
Capability inventory: The skill has access to Bash for command execution and Read, Grep, Glob for file system interaction.
Sanitization: No specific sanitization or validation of tool output is performed before processing.

scan